[dependabot]

Bumps the minor-and-patch group with 6 updates:

Package	From	To
github.com/prometheus/alertmanager	0.34.1	0.34.2
github.com/prometheus/common	0.72.1	0.73.0
k8s.io/api	0.37.1	0.37.2
k8s.io/apimachinery	0.37.1	0.37.2
k8s.io/client-go	0.37.1	0.37.2
sigs.k8s.io/gateway-api	1.6.3	1.7.0

Updates github.com/prometheus/alertmanager from 0.34.1 to 0.34.2

Release notes

Sourced from github.com/prometheus/alertmanager's releases.

0.34.2 / 2026-10-29

• [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
• [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943

Changelog

Sourced from github.com/prometheus/alertmanager's changelog.

0.34.2 / 2026-10-29

• [SECURITY] api: Alertmanager no longer sends CORS headers by default. This means api/v2 now disallows cross-origin requests. This is a breaking change. The new --web.cors.origin flag can be used to restore the previous behaviour. #5664
• [SECURITY] Build with Go 1.26.10, which distrusts the eight compromised eMudhra intermediate CA certificates in crypto/x509. CVE-2026-111943

Commits

• e834904 Prep release 0.34.2 (#5694)
• 4777273 feat(api): add --web.cors.origin flag (#5664)
• 949f674 chore(deps): bump Go to 1.26 and update dependencies
• See full diff in compare view

Updates github.com/prometheus/common from 0.72.1 to 0.73.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.73.0

What's Changed

• expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 by @​KR-Ravindra in prometheus/common#1008
• expfmt: add FmtOpenMetrics_2_0_0_rc format constant by @​bwplotka in prometheus/common#1020
• expfmt: add ABNF-based OpenMetrics 1.0 parser by @​bwplotka in prometheus/common#1015

New Contributors

• @​KR-Ravindra made their first contribution in prometheus/common#1008

Full Changelog: prometheus/common@v0.72.1...v0.73.0

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

Commits

• 983d509 expfmt: add ABNF-based OpenMetrics 1.0 parser (#1015)
• 220c51a expfmt: add FmtOpenMetrics_2_0_0_rc format constant (#1020)
• 25bdf5c expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 (#1008)
• See full diff in compare view

Updates k8s.io/api from 0.37.1 to 0.37.2

Commits

• 1bc0c52 Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.37.1 to 0.37.2

Commits

• 97adf14 Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.37.1 to 0.37.2

Commits

• 72c52dd Update dependencies to v0.37.2 tag
• See full diff in compare view

Updates sigs.k8s.io/gateway-api from 1.6.3 to 1.7.0

Release notes

Sourced from sigs.k8s.io/gateway-api's releases.

v1.7.0

Major Themes

Graduating to Standard

• HTTPRoute Retries (GEP-1731): the retry configuration of an HTTPRoute rule (codes, attempts and backoff) is promoted to the Standard channel, together with the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError conformance features. The backoff field is implementation-specific because backoff behavior, especially jitter, varies between implementations. (#5357, @​snorwin, #5359, @​mikemorris)

New in Experimental

• Gateway Address Routability (GEP-5093): routability is expressed per Gateway address, so a single Gateway can serve addresses of different scopes. Valid values are empty (implementation default), Cluster, or a domain-prefixed implementation-specific value. (#5304, @​rikatz)
• Standardized Attribute Dictionary (GEP-5253): a shared, vendor-neutral set of traffic attributes, based on OpenTelemetry semantic conventions, for use by features such as XTelemetryPolicy. (#5256, @​gkhom)
• Session Persistence on Backend (GEP-1619 and GEP-4894): session persistence is configured on the XBackend resource, and the route-inline and BackendTrafficPolicy attachment points are deprecated. (#4876, #5298, @​gcs278)
• Pre-routing Filters (GEP-5224): listener filters that run before routing decisions, for use cases such as external authentication and payload processing, with the new GatewayListenerFilters feature. Filters can be set on both Gateway and ListenerSet listeners. (#5315, @​jaellio, #5370, @​snorwin)
• ClusterTrustBundle in caCertificateRefs (GEP-5075): BackendTLSPolicy and Gateway frontend TLS validation can reference a ClusterTrustBundle through the existing caCertificateRefs field, instead of copying CA bundles into every namespace. (#5272, #5356, @​davidesalerno)
• TelemetryPolicy for Distributed Tracing (GEP-4768): the XTelemetryPolicy API standardizes tracing configuration for Gateways without vendor-specific CRDs. Metrics and access logs are not covered yet. (#5323, @​gkhom)

Major Changes Since v1.6.3

Breaking Changes

• Experimental API changes (no effect on the Standard channel):
  • SessionPersistence API: sessionName moved to cookie.name (Extended, optional) and header.name (Core, required), cookieConfig renamed to cookie, and HeaderConfig added. (#4873, @​gcs278)
  • SessionPersistence API: the cookie Path now defaults to / instead of being computed from route matches, and the new cookie.path field (Extended) allows explicit path configuration. (#5046, @​gcs278)
  • SessionPersistence: route-inline and BackendTrafficPolicy session persistence are deprecated in favor of the Backend resource. (#4876, @​gcs278)
  • XBackend: spec.port.port was renamed to spec.port.number, spec.port.name was removed, and backendRef.port is now prohibited when referencing an XBackend. (#5287, @​gcs278)
• Go types:
  • BackendAncestorStatus.AncestorRef was renamed in the generated Go types for consistency with docs and JSON/YAML serialization. (#5187, @​Stevenjin8)
  • ForwardBodyConfig.MaxSize changed type from uint16 to int32. (#5099, @​arjunxplorer)
• Conformance features:
  • The HTTPRouteRetry and HTTPRouteRetryBackendTimeout features were removed. HTTPRouteRetryCodes was added and HTTPRouteRetryConnectionError is retained. (#5167, @​snorwin)
  • The HTTPRouteBackendRequestRedirect feature and its test were removed. (#5279, @​snorwin)
• Go was upgraded to 1.27 (go 1.27.0 directive in go.mod and conformance/go.mod) and Kubernetes dependencies to v0.37. (#5297, @​snorwin, #5232, @​snorwin, #5388, @​howardjohn)

GEP & API Graduation

• GEP Status Updates:
  • GEP-4768 (TelemetryPolicy): add the proposal, then the experimental XTelemetryPolicy API (#4872, @​gkhom, #5323, #5345, @​robscott)
  • GEP-5093 (Gateway Address Routability): add as Provisional, move to Implementable, then to Experimental. (#5094, @​usize, #5263, @​rikatz, #5304, @​rikatz)
  • GEP-5224 (Pre-routing filters): add as Provisional, move to Implementable, then to Experimental. (#5235, @​jaellio, #5271, @​jaellio, #5315, @​jaellio)
  • GEP-5075 (ClusterTrustBundle caCertificateRef): add as Provisional, move to Experimental, then use caCertificateRefs instead of a dedicated reference type. (#5259, @​davidesalerno, #5272, @​davidesalerno, #5356, @​davidesalerno)
  • GEP-5253: Standardized Attribute Dictionary. (#5256, @​gkhom)
  • GEP-4359: Gateway API Regex. (#4764, @​Stevenjin8)
  • GEP-4360: Regex-based Path Rewrites. (#4695, @​Stevenjin8)
  • GEP-1619 (Session Persistence): synced with API updates and made the Backend the attachment point. (#4870, #4876, @​gcs278)
  • GEP-1731 (HTTPRoute Retries): aligned retry semantics with implementations, then loosened the backoff definition so it no longer requires an exponential strategy, and promoted the retry configuration, including backoff, to the Standard channel. (#5167, @​snorwin, #5359, @​mikemorris)
  • GEP-4894 (Backend): deferred SelectorRef in favor of the Selector field. (#5158, @​gcs278)
• Graduations to Standard:
  • HTTPRoute retry configuration (retry.codes and retry.attempts) is promoted to the Standard channel, and the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError features are now Standard. retry.backoff (implementation-specific) is promoted with them. (#5357, @​snorwin)
  • HTTPRoute and GRPCRoute rule name uniqueness validation is now enforced in the Standard channel. (#5009, @​snorwin)
  • BackendTLSPolicy SANs and TLS options are now marked as Standard channel. (#4999, @​Suvink)

... (truncated)

Commits

• e26d183 chore: Prep for v1.7.0 (#5433)
• e72a950 chore: release v1.7.0-rc.3 (#5423)
• d57b8ba chore: Release v1.7.0-rc.2 (#5416)
• 3992978 deps: bump dependencies before release (#5414)
• 5361fea fix: tlsroutemixedmode is standard, not experimental (#5412)
• c36d813 conformance: avoid nil Group panic in listener status matchers (#5411)
• bbff621 [release-1.7] HTTPRoute: Add conformance test with multiple Routes attachment...
• 0614538 replace coredns by echo-basic (#5408)
• 7285cf7 conformance: fix parentRefToString printing a pointer address (#5399)
• f7c3e5e [release-1.7] fix: add CEL to validate LabelKey in XBackend's endpointSelecto...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions